Commit Graph

101 Commits

Author SHA1 Message Date
momo5502
b2eef2bf46 Align processor counts 2025-08-17 07:31:37 +02:00
momo5502
9c29f26647 Small fixes 2025-08-17 07:26:11 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
5fbf065937 Handle debug strings via callback 2025-08-10 10:03:12 +02:00
CarlTSpeak
051cef2212 fix: handle VirtualAlloc invalid size and flags 2025-08-08 14:52:03 +01:00
CarlTSpeak
0aea1f5385 I just learned how clang-format works. Fail. 2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c Fixed platform portability issues 2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236 Fixed clang exception. Again. 2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a Added basic pipe support to NtRead/WriteFile 2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea Fixed clang-tidy issue 2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9 Fixed cross-platform: removed MS-specific macro 2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694 Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:35:31 +01:00
momo5502
6eb4ef33ff Handle invalid page protections
This fixes #420
2025-07-20 09:34:25 +02:00
Maurice Heumann
9e5a6b509b Implement guard pages (#406)
Hey, looking for feedback on my guard page implementation. 

I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.

This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.

The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21)
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel).

The test added to the `test-sample` binary seems to be passing.

Fixes #21
2025-07-17 17:41:06 +02:00
momo5502
ac2d34c143 Small cleanup 2025-07-12 15:40:04 +02:00
momo5502
7a3a5d760e Fix thread deletion 2025-07-12 15:28:30 +02:00
3fault
1276c7e2bc Update occurances of memory_permission to nt_memory_permission where needed 2025-07-01 19:04:22 -04:00
momo5502
08ae52710b Prevent translation of relative files 2025-06-16 18:38:55 +02:00
momo5502
bda89b5d1e Add more syscalls 2025-06-15 19:48:05 +02:00
momo5502
1421550764 Cleanup and fix NtQueryInformationProcess 2025-06-15 09:31:57 +02:00
Red
f14b16d080 Fix anti-debug detections for NtQueryInformationProcess with ProcessDebugObjectHandle 2025-06-14 15:00:53 +02:00
momo5502
906cec808a Small fixes 2025-06-07 20:10:36 +02:00
momo5502
05c5f0a085 Final cleanup 2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9 Cleanup exception callbacks 2025-06-07 07:54:11 +02:00
momo5502
802e295bcc Adapt more printing 2025-06-07 07:29:30 +02:00
momo5502
9372e27453 Fix module logging 2025-06-07 07:11:27 +02:00
momo5502
bc77faec3d Move more logging into callbacks 2025-06-06 20:03:53 +02:00
momo5502
f2e0e91630 Isolate more analysis into analyzer 2025-06-05 18:59:27 +02:00
momo5502
956e73d839 Some fixes 2025-06-04 20:47:51 +02:00
momo5502
1f829463c1 Use more semantic logging 2025-06-04 20:22:28 +02:00
momo5502
de0d9a17a5 Small fixes 2025-06-04 20:19:47 +02:00
momo5502
84e8e86b94 Extract sus activity logging 2025-06-04 19:28:50 +02:00
Maurice Heumann
dcee2982ce Update file.cpp 2025-06-03 11:18:10 +02:00
Igor Pissolati
9f32620220 Fix failing checks 2025-06-02 14:32:15 -03:00
Igor Pissolati
c67146ee45 Add new syscalls 2025-06-02 14:32:15 -03:00
Igor Pissolati
db1588623b Add KSecDD device and support for devices in NtQueryObject 2025-06-02 14:32:15 -03:00
Igor Pissolati
cc2266d934 Add new pseudo-handles 2025-06-02 14:32:15 -03:00
Igor Pissolati
ad3046466e Improvements to NtQueryInformationToken 2025-06-02 14:32:15 -03:00
momo5502
aa763c8392 Prepare more timer syscalls 2025-06-01 14:05:18 +02:00
momo5502
009961620b Fix thread deletion 2025-06-01 13:57:14 +02:00
momo5502
da658e5178 Prepare timer support 2025-06-01 13:56:45 +02:00
momo5502
c605131a80 Small changes 2025-06-01 12:48:59 +02:00
momo5502
ed80b86e22 Fix compilation 2025-06-01 07:54:42 +02:00
momo5502
e763fdac54 Support more syscalls 2025-05-31 21:27:32 +02:00
momo5502
bc92023652 Fix directory enumation with filesystem mappings 2025-05-31 16:31:24 +02:00
momo5502
b6f4645420 Some more syscalls 2025-05-31 13:21:19 +02:00
momo5502
8abc7a65ef Support svcctrl start event 2025-05-24 11:06:23 +02:00
momo5502
92bdf26669 Fix computername 2025-05-24 11:06:09 +02:00
Igor Pissolati
e0507aa2c5 Fix afd_endpoint::ioctl_connect 2025-05-21 19:28:27 -03:00